Port forwarding is like putting your apartment number and name on the door of the apartment complex, so someone coming would know which apartment to go.

This apartment is unlocked, it is the not “buzzing in kind”

So even if someone wants to break in and finds your door, the security and safety of your door what matters.

-–

Port forwarding in itself is “not” a security risk, if you are mindful, disable automatic port forwarding (uPnP) and open only the ports what is needed.

The security risks come from the softwares that listen to an opened port.

The internet itself is working on port forwarding, any website is port forwarded to the webserver on port 80,443 or 8080 by default. You are accessing a website right now. The security comes from the settings and safety of the webserver software itself. Whether it can be penetrated and access things that you are not supposed to.

-–

If you are considering opening a service to the world you should look up if that software has any security vulnerabilities.

Open source linux based software is better in this way, because many people tests the software and reports issues before it is released to stable version.

You can also bild your server in a way, where things are separated. Like having a webserver in a container.

The host is almost totally invisible from inside the container and it is nigh impossible (should be) to access the host computer other than the shared folders between host and container and you cannot navigate out of those folders.

-–

The most secure will always be a totally closed firewall. But letting trusted softwares to be accessed from outside is not much less insecure.

Do not trust what you see in movies, a “hacker” can’t just waltz into your network, unless your router and firewall has some serious security vulerabilities or god forbid, public facing backdoors

(some routers had some not so long ago, you should look up your own router for any news)